Vulnerabilities and security researches forcurrency-switcher currency-switcher

Mar 11, 2025

CVE, Research URL: CVE-2025-2169
Home page URL: Security reports for WPCS – WordPress Currency Switcher Professional
Application: WPCS – WordPress Currency Switcher Professional
Date: Mar 11, 2025
Research Description: The The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.0.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Affected versions: Min -, max -.
Status: vulnerable

Jul 14, 2024

CVE, Research URL: CVE-2024-38700
Home page URL: Security reports for WPCS – WordPress Currency Switcher Professional
Application: WPCS – WordPress Currency Switcher Professional
Date: Jul 12, 2024
Research Description: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in realmag777 WPCS allows Code Injection.This issue affects WPCS: from n/a through 1.2.0.3.
Affected versions: Min -, max -.
Status: vulnerable

Jun 07, 2024

CVE, Research URL: CVE-2021-20780
Home page URL: Security reports for WPCS – WordPress Currency Switcher Professional
Application: WPCS – WordPress Currency Switcher Professional
Date: Jul 07, 2021
Research Description: Cross-site request forgery (CSRF) vulnerability in WPCS - WordPress Currency Switcher 1.1.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2023-2556
Home page URL: Security reports for WPCS – WordPress Currency Switcher Professional
Application: WPCS – WordPress Currency Switcher Professional
Date: Jun 09, 2023
Research Description: The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the anonymous function for the wpcs_sd_delete action in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete an arbitrary custom drop-down currency switcher.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2023-2558
Home page URL: Security reports for WPCS – WordPress Currency Switcher Professional
Application: WPCS – WordPress Currency Switcher Professional
Date: Jun 09, 2023
Research Description: The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcs_current_currency shortcode in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2023-2555
Home page URL: Security reports for WPCS – WordPress Currency Switcher Professional
Application: WPCS – WordPress Currency Switcher Professional
Date: Jun 09, 2023
Research Description: The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create a custom drop-down currency switcher.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2023-2557
Home page URL: Security reports for WPCS – WordPress Currency Switcher Professional
Application: WPCS – WordPress Currency Switcher Professional
Date: Jun 09, 2023
Research Description: The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to edit an arbitrary custom drop-down currency switcher.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2023-51506
Home page URL: Security reports for WPCS – WordPress Currency Switcher Professional
Application: WPCS – WordPress Currency Switcher Professional
Date: Feb 01, 2024
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WPCS – WordPress Currency Switcher Professional allows Stored XSS.This issue affects WPCS – WordPress Currency Switcher Professional: from n/a through 1.2.0.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2024-30456
Home page URL: Security reports for WPCS – WordPress Currency Switcher Professional
Application: WPCS – WordPress Currency Switcher Professional
Date: Mar 29, 2024
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WPCS.This issue affects WPCS: from n/a through 1.2.0.1.
Affected versions: Min -, max -.
Status: vulnerable